I'm working on a side project (no, not that one) with a friend, and I just caught myself following some really bad practices (and I fixed an SQL Injection vulnerability, oh my!). I was doing something that appears pretty benign: I'm letting users rate content by clicking on an image, or a link for "No Rating" or Spam. They're all regular anchor links that link back to the page itself, with information embedded into GET on which item was being rated, and a nonce for csrf protection (else you could (if you were sneaky enough) make everyone rate your content well with a CSRF attack embedded into your own page).
Did you catch the problem? (after the jump)

The problem here is how I'm letting "people" rate the content, an anchor link. Sure it's quick, easy and it works, but it's bad. The HTTP spec calls for GET to be "Safe", which is somewhat loosely defined, but this most definetly doesn't fit. Rating an item has a lasting effect, the site remembers your rating, spam ratings are measured against the content to remove items etc. Fixing this took a bit of work on my side, switching the simple anchor tags to be form buttons, with data embedded into the name, but it's a really good idea. Search engines, and other spiders are smart enough not to POST data, but following regular anchor links is their job. If I had left it as is the next (first?) time the site got spidered the bot would have gone through and rated every single post with every single possible rating.